Advisories » MGASA-2026-0406

Updated zip packages fix a security vulnerability

Publication date: 14 Sep 2026
Modification date: 14 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2018-13410

Description

zip test option (-T) command injection.
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used,
allows attackers to cause a denial of service (invalid free and
application crash) or possibly have unspecified other impact because of
an off-by-one error. (CVE-2018-13410)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36143
• https://www.openwall.com/lists/oss-security/2026/08/14/1
• https://sintonen.fi/advisories/infozip-test-option-command-injection.txt
• https://lists.debian.org/debian-security-announce/2026/msg00350.html
• https://www.cve.org/CVERecord?id=CVE-2018-13410

SRPMS

10/core

• zip-3.0-17.1.mga10

9/core

• zip-3.0-14.1.mga9